The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted project-authored documentation (such as product.md and feature specs) which could contain malicious instructions designed to override agent behavior.
Ingestion points: Files are read in scripts/load_product_context.py and scripts/audit_product.py to extract product requirements and routes.
Boundary markers: The skill utilizes a wrap_untrusted_doc utility in scripts/_untrusted_doc.py that encapsulates untrusted content within <<<UNTRUSTED_PROJECT_DOC>>> tags, explicitly instructing the agent to treat the text as data only.
Capability inventory: The agent can perform file system writes within the .heyeddi/ directory and execute specific allowlisted sibling scripts via subprocess.
Sanitization: The implementation prioritizes structural delimiters and explicit instructional warnings to the agent to mitigate the risk of instruction leakage from data.
[COMMAND_EXECUTION]: The tool scripts/verify_product.py executes other scripts within the skill's own directory using the subprocess module.
Evidence: The script calls subprocess.run to orchestrate audit_product.py and check_features.py.
Mitigation: It employs a strict allowlist (_ALLOWED_SCRIPTS) and verifies that the resolved paths remain within the skill's local scripts directory, effectively preventing command injection or directory traversal attacks.

heyeddi-product